A text rule sees bytes, so no bundled rule can say "no unwrap outside cfg(test)"; a rule form over the parse tree the binary already builds

[HackingGate]

What

A text rule sees bytes. regexp, comment_regexp, prose_regexp and
require_regexp are the four pattern checks a set can carry, and every one of
them is a regex over a string. A rule that wants to say "no .unwrap() outside
#[cfg(test)]" or "no unsafe block without a SAFETY: comment naming the
invariant" cannot be written: the first needs to know which item the call sits
in and what attributes that item carries, the second needs the block and the
comment that precedes it as two nodes with an order, and neither is a property
of a line. What a consumer does today is approximate it with a regex that
formatting defeats, or leave the rule unwritten.

The binary already links tree-sitter and three grammars (tree-sitter-rust,
tree-sitter-python, tree-sitter-go, Cargo.toml) and walks a tree in two
places: src/comments.rs for comment_regexp and trivial_comments, and
src/evidence/syntax.rs for the function-declaration provider. Both hard-code
the walk. Nothing lets a set declare one.

Why it matters

The fleet is mostly Rust and Go, written mostly by agents, and the two rules
above are the ones a reviewer asks for by name. Each is a structural question
with a mechanical answer, which is exactly the tier ADR 0003 measured at 0.02 s
for three rules and placed under pre-commit. The rule form is the missing
piece, not the parser.

ADR 0003 and ADR 0005 both record "do not build a rule DSL over tree-sitter in
this binary", on two grounds: a structural rule this repository needs is
cheaper as a test beside the code, and a structural rule a consumer needs is
ast-grep's job. This issue asks to revisit the second ground only. A test
beside the code covers one repository; the fleet-wide rules above are the
policy/base/ argument again, one decision transcribed N times. And ast-grep
as a provider leaves the parse-failure rule (ADR 0003's own finding, that a
recovered tree reads exactly like a clean one) to each adopter, where this
binary already refuses a tree with an ERROR or MISSING node in
src/evidence/syntax.rs. If the ADR stands after that argument, close this
with the reason recorded there.

Proposed

A fifth pattern check, one field beside the other four, no discriminant:

[rule.no-unwrap-outside-tests]
query = '''
(call_expression
  function: (field_expression field: (field_identifier) @method)
  (#eq? @method "unwrap"))
'''
language = "rust"
message = "unwrap outside #[cfg(test)]: return the error or state why it cannot happen"
files.glob = ["*.rs"]

• query is a tree-sitter query in its own syntax, with the standard
  predicates. language names the grammar. A rule may add regexp, which then
  runs over the text of the captures rather than over the file, so a rule can
  say "an unsafe block whose preceding comment does not match SAFETY:" as
  a query plus a negative pattern over one capture.
• Grammars are the ones already linked, read off the same table comments.rs
  and evidence/syntax.rs use, so a language added there is a language this
  check reads. Rust first; Go and Python follow in a separate issue.
• The parse-failure rule from ADR 0003 applies as it does to the evidence
  provider: a selected file the grammar recovered rather than read is named,
  with the line, and the run is exit 2, never a shorter list of findings.
• Scope, exclusion, min_selected, the baseline and the allow marker are the
  ones every files.* rule already has. The four existing pattern checks do
  not change.

Not in scope

• Type or borrow information. "This unwrap is on an Option that is never
  None" is rustc's and clippy's question, and it runs as an external gate at
  the rung its cost puts it on.
• Anything that needs a solver.
• Cross-file questions; a query sees one tree.

What would close it

• One bundled set carrying at least one query rule, with fixtures that are two
  sources one construct apart with opposite verdicts, and a third that does not
  parse and is refused.
• A docs/REFERENCE.md section for the field, in the row of the table the other
  pattern checks sit in.
• cargo test unchanged for every existing text rule.
• ADR 0003's decision amended or a new ADR recording why the second ground no
  longer holds.

Related: #13 (the research issue that framed the tiers), #165 (the evidence
model this check reports into), ADR 0003, ADR 0005.

[HackingGate]

A prior-art pass over this issue, with a probe of the one ground it rests on.

The example rules are expressible in ast-grep today

ast-grep's relational rules (inside, has, precedes, follows, with
stopBy) and composites (all, any, not) plus kind cover both
examples: "$X.unwrap() not inside a mod_item that follows an
attribute_item matching cfg(test)", and "an unsafe_block whose
preceding sibling is not a line_comment matching SAFETY:". See
https://ast-grep.github.io/guide/rule-config/relational-rule.html . Both
checked on 0.45.3 against a fixture with one unwrap in and one outside a
#[cfg(test)] mod, and one unsafe block with and one without a
// SAFETY: line; each rule reported exactly the one it should (exit 1):

id: no-unwrap-outside-tests
language: rust
severity: error
rule:
  pattern: $X.unwrap()
  not:
    inside:
      kind: mod_item
      follows: { kind: attribute_item, regex: 'cfg\(test\)' }
      stopBy: end
---
id: unsafe-needs-safety
language: rust
severity: error
rule:
  kind: unsafe_block
  not:
    inside:
      kind: expression_statement
      follows: { kind: line_comment, regex: SAFETY }

ADR 0003
already assigns consumer structural rules to ast-grep, and the issue asks to
revisit that on the parse-failure ground only. So the probe is on that ground.

Probe: ast-grep 0.45.3 over a file that only partly parses

Scratch Rust file, two functions, each calling .unwrap(); the second
is fn broken( {, which tree-sitter-rust recovers by inserting a
MISSING ) (no ERROR node).

• ast-grep run -p '$X.unwrap()' -l rust: prints both matches, the one
  inside the broken function included, exit 0. Nothing says the file
  did not parse.
• ast-grep scan with a severity: error unwrap rule: both findings,
  exit 1. Same file with no match (a second fixture): exit 0.
• A second rule kind: ERROR: exit 1 on a file whose recovery produced
  an ERROR node, but exit 0 on the MISSING-only file above. kind: ERROR does not see a MISSING node, so the per-adopter workaround ADR
  0003 describes misses a whole class of recovered trees.
• A rule with no severity defaults to hint: findings print and the
  exit is 0. A rule that forgets severity: error is a gate that never
  fails.

Probe: does ast-grep fail open on a misspelled rule?

A peer read of this binary found that tree-sitter 0.27 applies only
eq?, not-eq?, match?, not-match?, any-of? and not-any-of?
by itself; a misspelled predicate, or is?, is-not? or set!, is
silently ignored, so an in-house query rule fails open unless the
loader rejects every other predicate. ast-grep 0.45.3, same probe
style:

• Misspelled key inside rule: (insde:, or insid: under not:):
  refused, exit 8, "unknown field", with the list of valid keys.
• Unknown key inside a constraint (regexx:): refused, exit 8.
• Constraint on an undefined metavariable: refused, exit 8.
• Misspelled kind: (call_expresion): refused, exit 8.
• Misspelled severity: value: refused.
• Unknown or misspelled top-level key (bogus:, or constraint:
  for constraints:): silently ignored, the rule runs without it. For
  constraints that widens the match set, which fails loud rather than
  open, but it is not a refusal.

So ast-grep's rule body is strict where a raw tree-sitter query is not,
and the remaining fail-open cases are the top-level keys and the
default severity, both checkable by reading the YAML before running it.

Proposal

Wrap ast-grep the way the supply-chain set wraps its scanners (host
binary, missing is exit 2), and keep only what ast-grep does not do:

1. The parse-failure refusal. It already exists as first_unparsed in
   src/evidence/syntax.rs, which gates on has_error() and walks for
   is_error() || is_missing(), so it covers the MISSING case kind: ERROR
   misses and names the line. Run it over the files the ast-grep rules
   select, before trusting a clean exit. That is the whole of the fail-closed
   piece uphold would keep, and it is small.
2. A load-time check on the consumer's rule YAML: every rule a set claims
   has severity: error, and no unknown top-level key.

That keeps ADR 0003's decision and moves its "a structural provider
carries one requirement the others do not" into the provider contract,
instead of adding a query DSL and a predicate allow-list to this binary.